Life with HFS+ as the file system may not have had the riches of snapshots, clone files or copy-on-write, but it was a great deal more transparent to the user. In recent weeks I’ve had several questions about what I can only term the quirks of APFS, as it’s implemented in Big Sur and later. These centre on two phenomena: the Update and Time Machine backup volumes.
As I recorded when I first tried to explain boot volume layout in Big Sur, in addition to the major volumes which appear on your boot disk, there are several minor ones which clutter up the list shown in /System/Volumes:
- BaseSystem, an empty folder
- FieldService, an empty folder
- FieldServiceDiagnostic, an empty folder
- FieldServiceRepair, an empty folder
- Hardware, shown as a volume or folder, containing files and folders
- iSCPreboot, shown as a volume or folder, containing files and folders
- Update, shown as a volume, containing files and folders
- xART or xarts, shown as a volume or folder, which may contain files and folders or appear empty
in addition to Macintosh HD, Recovery, Preboot and VM, which we expect.
Most of those have obvious purposes, apart from xART/xarts, which contains important items such as LocalPolicy files for Secure Boot on M1 Macs, and Update. Several of you have wondered why Update isn’t cleared away once the installation of a macOS update has been completed. Some of the answers to this are buried in one of the files found there, restore.log.
If you’re interested in reading a blow-by-blow account of what happened during the last macOS update, then restore.log makes fascinating reading when you have a few days to spare. Throughout macOS updates, there are two important source and update volumes, /private/tmp/tmp-mount-[letters]/ and /System/Volumes/Update/. Of those two, the former does appear to be removed following each update, while the latter is kept and re-used for the next one.
However, this Update volume doesn’t appear to be listed among those known to the main APFS file system. If you use
diskutil list or
diskutil apfs info, you won’t see any evidence of its existence on an Intel or M1 Mac. This suggests that what you see in the Update folder isn’t a regular volume like those in the system volume group. It’s likely that it’s synthesised and mounted as a volume from a folder in the same system container. This provides the updater with working storage for the update without having to use the Data volume. As it’s small and does still contain files which are going to be used by the next macOS updater, it’s best left well alone.
When I first wrote about Update and its companion volumes, I speculated that “Apple may in a future update hide them away”, but that clearly hasn’t happened yet.
Time Machine backups
To see these volumes, your Mac needs to be making Time Machine backups and you’ll need to show hidden items in the Finder (Command-Shift-.). Then, in the Finder, select the path /Volumes/.timemachine/[UUID]. At the top you’ll see a run of folders with names like 2022-04-10-112648.backup, and below them a series of volumes with names like ThunderBay2@snap-83101, each of which is an APFS (Case-sensitive) volume containing one of your Time Machine backups to APFS.
The regular ways to browse those backups are in the Time Machine app, or in the Finder’s normal view of your backup volume. This is the back door, which in itself is of little use. However, this mode of access can be useful if you see errors when ejecting your backup storage.
When it works properly, ejecting your backup store should automatically eject all these backup volumes. Some users have problems with that, and see notifications about the disk not being ejected properly when it is subsequently disconnected. This is the place to come if that happens: you can check that these backups are correctly ejected, and any that aren’t you should be able to eject manually before disconnecting the backup storage.